Java 8 Delayed – Oracle Getting Serious About Security

Oracle’s Mark Reinhold, chief architect of the Java Platform Group has written a blog post about Java 8’s postponement:

“Looking ahead, Oracle is committed to continue fixing security issues at an accelerated pace, to enhance the Java security model, and to introduce new security features. This work will require more engineer hours than we can free up by dropping features from Java 8 or otherwise reducing the scope of the release at this stage.”

There you have it, really. Oracle is committed to securing Java. Recently they’ve implemented Click to Play for Java Applets not signed by a legitimate certificate authority. An interesting move, though it’s unclear what effect it will have.

Java 8 is going to bring a number of important features, so it’s a strong move by Oracle to postpone it in order to focus on security. In my opinion, that shows they’re taking it more seriously.

Features like Click To Play are nice, but not new or particularly robust. Browsers have enabled Click To Play for out of date Java for some time now. Yet exploits have continued. Another layer of “click yes” is unlikely to deter attackers all too much.

I think it’s worth looking at Adobe FlashPlayer. In the last few months I can’t remember a single in-the-wild attack against it. Yet just a year or two ago it was one of the biggest holes a system could have, providing attackers the same type of opportunity as Java does now. But Adobe did a complete 180, they implemented multiple important hardening features, they forced their plugin into a sandbox for major browsers, and now it’s rarely attacked.

Attackers moved from Flash to Java, because it’s the last plugin to lack security, while maintaining popularity. If Java implements an integrity based sandbox, or finds other ways to reach the level that Flash has, attackers will be left yet again with the decision of where to go, and this time there won’t be as many low hanging fruits.

If Java does it right, and let’s hope they do, I think we’ll see a massive change in the way attacks work over the next year.